Anthony,
If, instead, I add a 5 second sleep in between steps b. and c. on the source
side, then the migration completes as expected. It seems that the "migrate"
monitor command is actually returning before everything is complete, so killing
off the guest on the source side makes the destination wait around forever.
Unfortunately, I haven't yet had time to look at it in any detail to see what's
going on in the Qemu side, but I thought I would give you a heads up, and maybe
you have an idea of where to look.